# Ensure default Internet Access from your Amazon AppStream fleet streaming instances should remain unchecked.

- Source: https://support.icompaas.com/support/solutions/articles/62000229596-ensure-default-internet-access-from-your-amazon-appstream-fleet-streaming-instances-should-remain-unc
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Policy Updates](https://support.icompaas.com/support/solutions/folders/62000168784)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**

This policy ensures that default Internet Access is unchecked for Amazon AppStream fleet streaming instances. This helps to mitigate the risk of unauthorized access to the internet from these instances.

**Rationale:**

By default, Amazon AppStream fleet streaming instances have default Internet Access enabled. This means that users can access the internet from these instances without any restrictions. However, this can also pose a security risk, as it allows users to access malicious websites or download malware.

**Impact:**

If default Internet Access is enabled for Amazon AppStream fleet streaming instances, users could potentially access malicious websites or download malware. This could lead to data breaches or other security incidents.

**Default Value:**

The default value for default Internet Access is **unchecked**. This means that users cannot access the internet from Amazon AppStream fleet streaming instances by default.

**Pre-requisites:**

-   Access to the AWS Management Console or the AWS CLI
-   The ability to manage Amazon AppStream fleets

**Remediation Steps:**

1.  Open the AWS Management Console or the AWS CLI.
2.  Go to the Amazon AppStream console.
3.  Click on Fleets.
4.  Select the fleet that you want to change the default Internet Access setting for.
5.  Click on the **Edit** button.
6.  In the **Network** section, uncheck the **Default Internet Access** checkbox.
7.  Click on the **Save** button.

**Test Plan:**

1.  Verify that the default Internet Access setting is unchecked for the fleet.
2.  Try to access a website from one of the streaming instances in the fleet.
3.  Verify that you are unable to access the website.

**Implementation Plan:**

1.  Follow the remediation steps above to implement the policy.
2.  Test the policy to make sure that it is working as expected.

**AWS CLI Process:**

To implement the policy using the AWS CLI, you can use the following command:

```
aws appstream update-fleet --fleet-name <fleet-name> --default-internet-access disabled
```

**Using AWS GUI:**

To implement the policy using the AWS GUI, you can follow these steps:

1.  Go to the AWS Management Console.
2.  Click on the Amazon AppStream tab.
3.  Click on Fleets.
4.  Select the fleet that you want to change the default Internet Access setting for.
5.  Click on the **Edit** button.
6.  In the **Network** section, uncheck the **Default Internet Access** checkbox.
7.  Click on the **Save** button.

**Backout Plan:**

To revoke the policy, you can use the following command:

```
aws appstream update-fleet --fleet-name <fleet-name> --default-internet-access enabled
```

**Note:**

-   This policy only applies to Amazon AppStream fleet streaming instances.
-   If you have any questions about this policy, please contact your AWS administrator.

**Reference:**

-   Amazon AppStream 2.0 documentation: https://docs.aws.amazon.com/appstream2/latest/developerguide/

**Section 2:**

-   Tags: security, internet, access, amazon appstream
-   Keywords: default internet access, amazon appstream, AWS policy

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.